With rsyslog 7.1.3 we introduced the opportunity to set variables inside the rsyslog.conf. Though, this does not work with standard properties, this can be done with CEE/lumberjack-type properties. Variable customization should be considered an aid for template generation and modification.

Note that CEE/lumberjack properties, as implemented in rsyslog, can be hierarchical and levels are delimited by the bang sign (based on lumberjack recommendations). So “!uid” is the uid field in the CEE root, whereas “!usr!uid” is the uid field inside the usr container. Nesting can be as deep as desired. Currently, all parts of the CEE tree can be accessed. In later versions, this may require the setting of a global option.

A variable can be set by using the following:

set varname = expression;

Please note the semicolon at the end. This is needed to separate from other config lines as well as to keep compatibility with older versions. The expression can be an arbitrary complex expression, just like in an “if” statement.

COMMUNITY

About

Related Products

rsyslog.com uses cookies to ensure that we give you the best experience on our website. If you continue to use this site, you confirm and accept the use of Cookies on our site. You will find more informations in our Data Privacy Policy.OkRead more